kfox1111andFaisal Memon
f4c7df239e
* Add broker suport to the spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
75 lines
2.3 KiB
YAML
75 lines
2.3 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: federation-test
|
|
spec:
|
|
backoffLimit: 0
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: federation-test
|
|
spec:
|
|
restartPolicy: Never
|
|
initContainers:
|
|
- name: static-busybox
|
|
# Replaced by run-tests.sh with the image from the spiffe-oidc-discovery-provider chart
|
|
image: replaced-by-run-tests.sh
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
cp /bin/busybox /data/busybox
|
|
chmod +x /data/busybox
|
|
volumeMounts:
|
|
- name: data-volume
|
|
mountPath: /data
|
|
containers:
|
|
- name: main
|
|
# Replaced by run-tests.sh with the image from the spire-agent chart
|
|
image: replaced-by-run-tests.sh
|
|
command:
|
|
- /data/busybox
|
|
- sh
|
|
- -xc
|
|
- |
|
|
SOCK=/spire-agent/spire-agent.sock
|
|
i=0
|
|
while [ "$i" -lt 60 ]; do
|
|
if XOUT=$(/opt/spire/bin/spire-agent api fetch x509 -socketPath "$SOCK" -write /data -timeout 5s 2>&1) &&
|
|
echo "$XOUT" | /data/busybox grep -q "for trust domain other.org" &&
|
|
JOUT=$(/opt/spire/bin/spire-agent api fetch jwt -audience test -socketPath "$SOCK" -timeout 5s 2>&1) &&
|
|
echo "$JOUT" | /data/busybox grep -q "bundle(other.org)"; then
|
|
# The other.org bundle was statically set to the same single CA on both sides,
|
|
# so every federated bundle delivered must contain exactly one certificate.
|
|
for f in /data/federated_bundle.*.pem; do
|
|
COUNT=$(/data/busybox grep -c "BEGIN CERTIFICATE" "$f")
|
|
if [ "$COUNT" != "1" ]; then
|
|
echo "expected 1 CA in $f, got $COUNT"
|
|
exit 1
|
|
fi
|
|
done
|
|
echo "$XOUT"
|
|
echo "$JOUT"
|
|
echo FEDERATION-OK
|
|
exit 0
|
|
fi
|
|
i=$((i+1))
|
|
/data/busybox sleep 2
|
|
done
|
|
echo "$XOUT"
|
|
echo "$JOUT"
|
|
exit 1
|
|
volumeMounts:
|
|
- name: data-volume
|
|
mountPath: /data
|
|
- name: spire-api
|
|
mountPath: /spire-agent
|
|
readOnly: true
|
|
volumes:
|
|
- name: data-volume
|
|
emptyDir: {}
|
|
- name: spire-api
|
|
csi:
|
|
driver: csi.spiffe.io
|
|
readOnly: true
|